Oauth Tray Approve Request

Funnel-only beacon, same endpoint for both stages (#3727 review — no new route): 'tray_offered' (JS fired the deep link) or 'noapp' (the ~6s no-tray timeout showed the noapp state). The actual approval handshake is page→localhost→tray→/oauth/tray-approve. Two literal calls, not one ternary: test_paneles_cuentan_eventos_con_emisor.py's emitter-detector regex requires the type to be the literal first argument of _log_event.